Vulnerability in Safe Contracts (All Versions Affected) Part One

> Hold on tight for this one, it's going to be a long night because I'm going to walk down this entire situation in here and elsewhere (Twitter, GitHub, Substack, Medium etc.)

Going to break this down succinctly in the next few posts since the Safe team didn't want to acknowledge this in a timely manner. Not sure whether they triaged this or not, but I'll get straight to the point here.

This attack vector was more than likely exploited in both the Bybit & WazirX hacks. If you remember, the WazirX hack occurred back in July 2024.

In both cases:

1. Gnosis Safe contracts were used. In WazirX the 1.3.0 version of the logic contract was used. In the case of Bybit, the 1.1.1 version of the Safe contracts were used.

2. Both Safe deployments were multi-signature. WazirX's multi-sig deployment was much more sophisticated than the setup we saw for Bybit. Wazir had 3 signers on the exchange's end that signed off on a transaction, then they sent their transaction over to Liminal (3rd party provider) to sign off on a given transaction as a final confirmation. Also Wazir was using a more recent version of the Safe contracts. All signers were using separate devices to sign transactions and they were all physically separate from one another and none of their devices were compromised. There also was no narrative about Safe's UI being compromised. Liminal was accused of having their UI compromised, but they vehemently denied this claim.

The narrative has been that some sort of sophisticated UI swap took place. That's cap. Let me go ahead and publish what I have debunking that first.